feat(sre): enforce typed controlled automation

scripts/ops/tests/test_alertmanager_runtime_scrape_contract.py

@@ -0,0 +1,38 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[3]
+SCRIPT = ROOT / "scripts" / "ops" / "deploy-alertmanager-runtime-scrape.sh"
+
+
+def test_controlled_scrape_apply_has_check_rollback_and_independent_verifier() -> None:
+    text = SCRIPT.read_text(encoding="utf-8")
+
+    assert 'TRACE_ID="${TRACE_ID:?TRACE_ID is required}"' in text
+    assert 'RUN_ID="${RUN_ID:?RUN_ID is required}"' in text
+    assert 'WORK_ITEM_ID="${WORK_ITEM_ID:?WORK_ITEM_ID is required}"' in text
+    assert "promtool check config" in text
+    assert "writes_performed=0" in text
+    assert "rollback_receipt" in text
+    assert "terminal=rollback_failed ready=false" in text
+    assert "flock -n 9" in text
+    assert '!= "${CANDIDATE_SHA}"' in text
+    assert '!= "${SOURCE_SHA}"' in text
+    assert "alertmanager_notification_requests_total" in text
+    assert "alertmanager_notification_requests_failed_total" in text
+    assert 'receiver="awoooi-webhook"' in text
+    assert text.count('receiver="awoooi-webhook"') >= 4
+    assert "two_scrapes_up" in text
+    assert "delivery_series_count" in text
+
+
+def test_controlled_scrape_apply_never_replaces_the_full_live_config() -> None:
+    text = SCRIPT.read_text(encoding="utf-8")
+
+    assert "BEGIN AWOOOI ALERTMANAGER RUNTIME DELIVERY TRUTH" in text
+    assert "job_name: 'alertmanager-runtime'" in text
+    assert "targets: ['alertmanager:9093']" in text
+    assert "legacy_pattern" in text
+    assert "k8s/monitoring/prometheus.yml" not in text

scripts/ops/tests/test_alertmanager_webhook_config.py

@@ -7,6 +7,7 @@ import yaml
 
 ROOT = Path(__file__).resolve().parents[3]
 ALERTMANAGER_CONFIG = ROOT / "ops" / "alertmanager" / "alertmanager.yml"
+DEPLOY_SCRIPT = ROOT / "scripts" / "ops" / "deploy-alertmanager-config.sh"
 
 
 def _config() -> dict:
@@ -37,3 +38,70 @@ def test_emergency_direct_telegram_stays_limited_to_alert_chain() -> None:
     route_text = str(_config()["route"])
     assert "AWOOOIApiDown" in route_text
     assert 'severity="critical"' in route_text
+
+
+def test_emergency_card_is_bounded_and_has_honest_automation_attribution() -> None:
+    receiver = _receiver("telegram-direct")
+    telegram = receiver["telegram_configs"][0]
+    message = telegram["message"]
+
+    assert "SRE BYPASS｜告警主鏈異常" in message
+    assert "Prometheus deterministic rule（未呼叫 LLM）" in message
+    assert "Executor：none" in message
+    assert "未宣稱已修復" in message
+    assert "Verifier：source-specific delivery metric" in message
+    assert "故障主機" not in message
+    telegram_route = next(
+        route
+        for route in _config()["route"]["routes"]
+        if route["receiver"] == "telegram-direct"
+    )
+    assert telegram_route["repeat_interval"] == "2h"
+
+
+def test_alertmanager_has_no_agent99_inbound_receiver_or_secret_first_hop() -> None:
+    config = _config()
+    assert all(
+        item.get("receiver") != "agent99-alert-chain-relay"
+        for item in config["route"]["routes"]
+    )
+    assert all(
+        receiver.get("name") != "agent99-alert-chain-relay"
+        for receiver in config["receivers"]
+    )
+    source = ALERTMANAGER_CONFIG.read_text(encoding="utf-8")
+    assert "192.168.0.99:8787" not in source
+    assert "AGENT99_SRE_RELAY_TOKEN_PLACEHOLDER" not in source
+    assert "authorization:" not in source
+
+
+def test_alertmanager_deploy_does_not_inject_agent99_relay_secret() -> None:
+    source = DEPLOY_SCRIPT.read_text(encoding="utf-8")
+    assert "AGENT99_SRE_ALERT_RELAY_TOKEN" not in source
+    assert 'os.environ["AGENT99_SRE_RELAY_TOKEN"]' not in source
+    assert "AGENT99_SRE_RELAY_TOKEN_PLACEHOLDER" not in source
+    assert "unreplaced secret placeholder remains" in source
+    assert "set -x" not in source
+
+
+def test_secret_bearing_alertmanager_config_and_backups_are_not_world_readable() -> None:
+    source = DEPLOY_SCRIPT.read_text(encoding="utf-8")
+
+    assert "install -m 0600" in source
+    assert 'chmod 0600 "\\$legacy_backup"' in source
+    assert 'chmod 0400 "\\$target"' in source
+    assert 'chmod 0000 "\\$target"' in source
+    assert "chmod 0644" not in source
+    assert "/proc/\\${container_pid}/status" in source
+    assert "runtime_uid" in source
+    assert "runtime_gid" in source
+    assert "test -r /etc/alertmanager/alertmanager.yml" in source
+    assert "rollback_secure" in source
+    assert "secure rollback attempted" in source
+    assert "amtool check-config /etc/alertmanager/alertmanager.yml" in source
+    assert "amtool check-config /dev/stdin" in source
+    assert "/tmp/alertmanager-rendered.yml" not in source
+    assert "trap 'rm -f \"\\$staged\"' EXIT" in source
+    assert source.index('chmod 0000 "\\$target"') < source.index(
+        "sudo -n sh -c 'cat \"\\$1\" > \"\\$2\"'"
+    )